-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RustRustMiggo AIRoot Cause AnalysisThe vulnerability stems directly from the set_host implementation handling string inputs. The Valgrind trace shows strlen() being called on invalid memory when passed an empty string, and the GitHub PR #1968 fixes this by converting to CString first. The function's pre-patch code directly used &str's raw pointer without ensuring NUL-termination, making it the clear vulnerable entry point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| openssl | rust | >= 0.10.0, < 0.10.55 | 0.10.55 |
Ongoing coverage of React2Shell